Operational Semantics of Security Protocols

Abstract

Based on a concise domain analysis we develop a formal semantics of security protocols. Its main virtue is that it is a generic model, in the sense that it is parameterized over e.g. the intruder model. Further characteristics of the model are a straightforward handling of parallel execution of multiple protocols, locality of security claims, the binding of local constants to role instances, and explicitly defined initial intruder knowledge. We validate our framework by analysing the Needham-Schroeder-Lowe protocol.

Untraceability of RFID Protocols

“…In short, we require that the behavior of a number of agents executing a security protocol is described by a set of traces in which we can identify the events belonging to the same run. A full semantics satisfying our requirements can be found in [43].…”

A Formal Semantics for Protocol Narrations

“…Note that this confusion also rules out the naïve modelling of concurrent sessions by the bare unbounded replication within spi-calculus. Some inspiration from the work of Cremers and Mauw [CM05] and the work done in the context of mixed strand spaces [THG99a,GT00] may help us here.…”

Alice and Bob: Reconciling Formal Models and Implementation

“…Similar to [15], we define the semantics of operational strands as an infinitestate transition system, where a state (S; K; E) consists of (1) a set S of closed strands, (i.e., every variable occurs first in a receive message, in a macro, or in a creation of a fresh value), (2) a set K of messages (the intruder knowledge), and (3) a set E of events that have occurred. This transition system is defined by an initial state and a transition relation.…”

“…In Appendix A, we define a semantics as state-transition systems similar to [15], where a state (S; K; E) consists of a set S of strands, a set K of messages that the intruder currently knows and a set E of events that have occurred. For instance, if S contains the strand send(insec, t).rest, where insec represents an insecure channel, then we can make the transition to a successor state where t is added to K and the send step is removed from the given strand.…”